Bug 513202 – net-misc/networkmanager-openvpn-0.9.8.4 - add support to drop root privileges and chroot

• Status: RESOLVED UPSTREAM
• Product: Gentoo Linux

[Description Matthias Maier 2014-06-14 10:46:18 UTC]

openvpn has a facility to drop root privileges and chroot to an empty directory after completed initialization. This is done be specifying
  "--user [...] --group [...] --chroot [...]"
on the command line.

However, the networkmanager plugin does not do this and always runs openvpn with full root privileges - while other networkmanager plugins drop root privileges (e.g. networkmanager-openconnect).

Please find attached a small patch (more a proof of concept) against the networkmanager-openvpn that adds above command line to the invocation of openvpn.


This should probably go along with a

     enewgroup nm-openvpn
     enewuser nm-openvpn -1 -1 -1 nm-openvpn

     + create chroot directory (e.g. /var/lib/openvpn/chroot)

in the appropriate ebuild phases.

Reproducible: Always

[Comment 1 Matthias Maier 2014-06-14 10:47:36 UTC]

Created attachment 378862 [details, diff]
Patch against sources to add --user ... --group ... --chroot ... to the command line

[Comment 2 Alexandre Rostovtsev (RETIRED) 2014-06-18 03:22:36 UTC]

Please submit this patch upstream to https://bugzilla.gnome.org/show_bug.cgi?id=555518

[Comment 3 Pacho Ramos 2014-09-23 11:59:56 UTC]

https://bugzilla.gnome.org/show_bug.cgi?id=555518#c3

Forwarded